https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T12:36:27.620707+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292282 EUVD-2026-292282 2026-10-05T12:36:27.652590+00:00 EUVD-2026-292282 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40565 fkie_cve-2026-40565 2026-10-05T12:36:27.652626+00:00

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML attributes. Version 1.8.213 fixes the issue.